fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@ecomplus/application-sdk	^22.0.0-firestore.1.15.5 → ^22.0.0-firestore.1.15.7			dependencies	patch
axios (source)	^0.23.0 → ^0.30.2			dependencies	minor
express (source)	^4.17.1 → ^4.22.1			dependencies	minor
firebase-functions	^3.15.7 → ^3.24.1			dependencies	minor
firebase-tools	^9.20.0 → ^9.23.3			dependencies	minor
node (source)	14 → 14.21.3			engines	minor
node	12.x → 12.22.12			uses-with	minor
node	10.x → 10.24.1			uses-with	minor
uglify-js	^3.14.2 → ^3.19.3			dependencies	minor

---

Release Notes

ecomplus/application-sdk (@​ecomplus/application-sdk)

v22.0.0-firestore.1.15.7

Compare Source

v22.0.0-firestore.1.15.6

Compare Source

axios/axios (axios)

v0.30.2

Compare Source

What's Changed

• Backport maxContentLength vulnerability fix to v0.x by @​FeBe95 in #​7034

New Contributors

• @​FeBe95 made their first contribution in #​7034

Full Changelog: axios/axios@v0.30.1...v0.30.2

v0.30.1

Compare Source

Release notes:

Bug Fixes

• chore(deps): bump form-data from 4.0.0 to 4.0.4 for v0.x by @​wolandec in #​6978

Contributors to this release

• @​wolandec made their first contribution in #​6978

Full Changelog: axios/axios@v0.30.0...v0.30.1

v0.30.0

Compare Source

Release notes:

Bug Fixes

• fix: modify log while request is aborted by @​mori5321 in #​4917
• fix: update CHANGELOG.md for v0.x by @​TehZarathustra in #​6271
• fix: modify upgrade guide for 0.28.1's breaking change by @​nafeger in #​6787
• fix: backport allowAbsoluteUrls vulnerability fix to v0.x by @​thatguyinabeanie in #​6829
• fix: add allowAbsoluteUrls type by @​thatguyinabeanie in #​6849

Contributors to this release

• @​mori5321 made their first contribution in #​4917
• @​TehZarathustra made their first contribution in #​6271
• @​nafeger made their first contribution in #​6787
• @​thatguyinabeanie made their first contribution in #​6829

Full Changelog: axios/axios@v0.29.0...v0.30.0

v0.29.0

Compare Source

Release notes:

Bug Fixes

• fix(backport): backport security fixes in commits #​6167 and #​6163 to v0.x by @​Sean-Powell in #​6402
• fix: omit nulls in params by @​Willshaw in #​6394
• fix(backport): fix paramsSerializer function validation by @​solonzhu in #​6361
• fix: Regular Expression Denial of Service (ReDoS) by @​qiongshusheng in #​6708

Contributors to this release

• @​Sean-Powell made their first contribution in #​6402
• @​Willshaw made their first contribution in #​6394
• @​solonzhu made their first contribution in #​6361
• @​qiongshusheng made their first contribution in #​6708

v0.28.1

Compare Source

Release notes:

Release notes:

Bug Fixes

• fix(backport): custom params serializer support (#​6263)
• fix(backport): uncaught ReferenceError req is not defined (#​6307)

v0.28.0

Compare Source

Release notes:

Bug Fixes

• fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (#​6091)

Backports from v1.x:

• Allow null indexes on formSerializer and paramsSerializer v0.x (#​4961)
• Fixing content-type header repeated #​4745
• Fixed timeout error message for HTTP 4738
• Added axios.formToJSON method (#​4735)
• URL params serializer (#​4734)
• Fixed toFormData Blob issue on node>v17 #​4728
• Adding types for progress event callbacks #​4675
• Fixed max body length defaults #​4731
• Added data URL support for node.js (#​4725)
• Added isCancel type assert (#​4293)
• Added the ability for the url-encoded-form serializer to respect the formSerializer config (#​4721)
• Add string[] to AxiosRequestHeaders type (#​4322)
• Allow type definition for axios instance methods (#​4224)
• Fixed AxiosError stack capturing; (#​4718)
• Fixed AxiosError status code type; (#​4717)
• Adding Canceler parameters config and request (#​4711)
• fix(types): allow to specify partial default headers for instance creation (#​4185)
• Added blob to the list of protocols supported by the browser (#​4678)
• Fixing Z_BUF_ERROR when no content (#​4701)
• Fixed race condition on immediate requests cancellation (#​4261)
• Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance #​4248
• Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (#​4229)
• Fix TS definition for AxiosRequestTransformer (#​4201)
• Use type alias instead of interface for AxiosPromise (#​4505)
• Include request and config when creating a CanceledError instance (#​4659)
• Added generic TS types for the exposed toFormData helper (#​4668)
• Optimized the code that checks cancellation (#​4587)
• Replaced webpack with rollup (#​4596)
• Added stack trace to AxiosError (#​4624)
• Updated AxiosError.config to be optional in the type definition (#​4665)
• Removed incorrect argument for NetworkError constructor (#​4656)

v0.27.2

Compare Source

Fixes and Functionality:

• Fixed FormData posting in browser environment by reverting #​3785 (#​4640)
• Enhanced protocol parsing implementation (#​4639)
• Fixed bundle size

v0.27.1

Compare Source

Fixes and Functionality:

• Removed import of url module in browser build due to huge size overhead and builds being broken (#​4594)
• Bumped follow-redirects to ^1.14.9 (#​4615)

v0.27.0

Compare Source

Breaking changes:

• New toFormData helper function that allows the implementor to pass an object and allow axios to convert it to FormData (#​3757)
• Removed functionality that removed the the Content-Type request header when passing FormData (#​3785)
• (*) Refactored error handling implementing AxiosError as a constructor, this is a large change to error handling on the whole (#​3645)
• Separated responsibility for FormData instantiation between transformRequest and toFormData (#​4470)
• (*) Improved and fixed multiple issues with FormData support (#​4448)

QOL and DevX improvements:

• Added a multipart/form-data testing playground allowing contributors to debug changes easily (#​4465)

Fixes and Functionality:

• Refactored project file structure to avoid circular imports (#​4515) & (#​4516)
• Bumped follow-redirects to ^1.14.9 (#​4562)

Internal and Tests:

• Updated dev dependencies to latest version

Documentation:

• Fixing incorrect link in changelog (#​4551)

Notes:

• (*) Please read these pull requests before updating, these changes are very impactful and far reaching.

v0.26.1

Compare Source

Fixes and Functionality:

• Refactored project file structure to avoid circular imports (#​4220)

v0.26.0

Compare Source

Fixes and Functionality:

• Fixed The timeoutErrorMessage property in config not work with Node.js (#​3581)
• Added errors to be displayed when the query parsing process itself fails (#​3961)
• Fix/remove url required (#​4426)
• Update follow-redirects dependency due to Vulnerability (#​4462)
• Bump karma from 6.3.11 to 6.3.14 (#​4461)
• Bump follow-redirects from 1.14.7 to 1.14.8 (#​4473)

v0.25.0

Compare Source

Breaking changes:

• Fixing maxBodyLength enforcement (#​3786)
• Don't rely on strict mode behaviour for arguments (#​3470)
• Adding error handling when missing url (#​3791)
• Update isAbsoluteURL.js removing escaping of non-special characters (#​3809)
• Use native Array.isArray() in utils.js (#​3836)
• Adding error handling inside stream end callback (#​3967)

Fixes and Functionality:

• Added aborted even handler (#​3916)
• Header types expanded allowing boolean and number types (#​4144)
• Fix cancel signature allowing cancel message to be undefined (#​3153)
• Updated type checks to be formulated better (#​3342)
• Avoid unnecessary buffer allocations (#​3321)
• Adding a socket handler to keep TCP connection live when processing long living requests (#​3422)
• Added toFormData helper function (#​3757)
• Adding responseEncoding prop type in AxiosRequestConfig (#​3918)

Internal and Tests:

• Adding axios-test-instance to ecosystem (#​3786)
• Optimize the logic of isAxiosError (#​3546)
• Add tests and documentation to display how multiple inceptors work (#​3564)
• Updating follow-redirects to version 1.14.7 (#​4379)

Documentation:

• Fixing changelog to show corrext pull request (#​4219)
• Update upgrade guide for https proxy setting (#​3604)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Jay
• Rijk van Zanten
• Kohta Ito
• Brandon Faulkner
• Stefano Magni
• enofan
• Andrey Pechkurov
• Doowonee
• Emil Broman
• Remco Haszing
• Black-Hole
• Wolfram Kriesing
• Andrew Ovens
• Paulo Renato
• Ben Carp
• Hirotaka Tagawa
• 狼族小狈
• C. Lewis
• Felipe Carvalho
• Daniel
• Gustavo Sales

v0.24.0

Compare Source

Breaking changes:

• Revert: change type of AxiosResponse to any, please read lengthy discussion here: (#​4141) pull request: (#​4186)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Jay
• Rodry
• Remco Haszing
• Isaiah Thomason

expressjs/express (express)

v4.22.1

Compare Source

v4.22.0

Compare Source

v4.21.2

Compare Source

What's Changed

• Add funding field (v4) by @​bjohansebas in #​6065
• deps: path-to-regexp@​0.1.11 by @​blakeembrey in #​5956
• deps: bump path-to-regexp@​0.1.12 by @​jonchurch in #​6209
• Release: 4.21.2 by @​UlisesGascon in #​6094

Full Changelog: expressjs/express@4.21.1...4.21.2

v4.21.1

Compare Source

What's Changed

• Backport a fix for CVE-2024-47764 to the 4.x branch by @​joshbuker in #​6029
• Release: 4.21.1 by @​UlisesGascon in #​6031

Full Changelog: expressjs/express@4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

• Deprecate "back" magic string in redirects by @​blakeembrey in #​5935
• finalhandler@​1.3.1 by @​wesleytodd in #​5954
• fix(deps): serve-static@​1.16.2 by @​wesleytodd in #​5951
• Upgraded dependency qs to 6.13.0 to match qs in body-parser by @​agadzinski93 in #​5946

New Contributors

• @​agadzinski93 made their first contribution in #​5946

Full Changelog: expressjs/express@4.20.0...4.21.0

v4.20.0

Compare Source

==========

• deps: serve-static@​0.16.0
  • Remove link renderization in html while redirecting
• deps: send@​0.19.0
  • Remove link renderization in html while redirecting
• deps: body-parser@​0.6.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
• Remove link renderization in html while using res.redirect
• deps: path-to-regexp@​0.1.10
  • Adds support for named matching groups in the routes using a regex
  • Adds backtracking protection to parameters without regexes defined
• deps: encodeurl@~2.0.0
  • Removes encoding of \, |, and ^ to align better with URL spec
• Deprecate passing options.maxAge and options.expires to res.clearCookie
  • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

• Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

• Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

==========

• Prevent open redirect allow list bypass due to encodeurl
• deps: cookie@​0.6.0

v4.18.3

Compare Source

==========

• Fix routing requests without method
• deps: body-parser@​1.20.2
  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
  • deps: raw-body@​2.5.2
• deps: cookie@​0.6.0
  • Add partitioned option

v4.18.2

Compare Source

===================

• Fix regression routing a large stack in a single route
• deps: body-parser@​1.20.1
  • deps: qs@​6.11.0
  • perf: remove unnecessary object clone
• deps: qs@​6.11.0

v4.18.1

Compare Source

===================

• Fix hanging on large stack of sync routes

v4.18.0

Compare Source

===================

• Add "root" option to res.download
• Allow options without filename in res.download
• Deprecate string and non-integer arguments to res.status
• Fix behavior of null/undefined as maxAge in res.cookie
• Fix handling very large stacks of sync middleware
• Ignore Object.prototype values in settings through app.set/app.get
• Invoke default with same arguments as types in res.format
• Support proper 205 responses using res.send
• Use http-errors for res.format error
• deps: body-parser@​1.20.0
  • Fix error message for json parse whitespace in strict
  • Fix internal error when inflated body exceeds limit
  • Prevent loss of async hooks context
  • Prevent hanging when request already read
  • deps: depd@​2.0.0
  • deps: http-errors@​2.0.0
  • deps: on-finished@​2.4.1
  • deps: qs@​6.10.3
  • deps: raw-body@​2.5.1
• deps: cookie@​0.5.0
  • Add priority option
  • Fix expires option to reject invalid dates
• deps: depd@​2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: finalhandler@​1.2.0
  • Remove set content headers that break response
  • deps: on-finished@​2.4.1
  • deps: statuses@​2.0.1
• deps: on-finished@​2.4.1
  • Prevent loss of async hooks context
• deps: qs@​6.10.3
• deps: send@​0.18.0
  • Fix emitted 416 error missing headers property
  • Limit the headers removed for 304 response
  • deps: depd@​2.0.0
  • deps: destroy@​1.2.0
  • deps: http-errors@​2.0.0
  • deps: on-finished@​2.4.1
  • deps: statuses@​2.0.1
• deps: serve-static@​1.15.0
  • deps: send@​0.18.0
• deps: statuses@​2.0.1
  • Remove code 306
  • Rename 425 Unordered Collection to standard 425 Too Early

v4.17.3

Compare Source

===================

• deps: accepts@~1.3.8
  • deps: mime-types@~2.1.34
  • deps: negotiator@​0.6.3
• deps: body-parser@​1.19.2
  • deps: bytes@​3.1.2
  • deps: qs@​6.9.7
  • deps: raw-body@​2.4.3
• deps: cookie@​0.4.2
• deps: qs@​6.9.7
  • Fix handling of __proto__ keys
• pref: remove unnecessary regexp for trust proxy

v4.17.2

Compare Source

===================

• Fix handling of undefined in res.jsonp
• Fix handling of undefined when "json escape" is enabled
• Fix incorrect middleware execution with unanchored RegExps
• Fix res.jsonp(obj, status) deprecation message
• Fix typo in res.is JSDoc
• deps: body-parser@​1.19.1
  • deps: bytes@​3.1.1
  • deps: http-errors@​1.8.1
  • deps: qs@​6.9.6
  • deps: raw-body@​2.4.2
  • deps: safe-buffer@​5.2.1
  • deps: type-is@~1.6.18
• deps: content-disposition@​0.5.4
  • deps: safe-buffer@​5.2.1
• deps: cookie@​0.4.1
  • Fix maxAge option to reject invalid values
• deps: proxy-addr@~2.0.7
  • Use req.socket over deprecated req.connection
  • deps: forwarded@​0.2.0
  • deps: ipaddr.js@​1.9.1
• deps: qs@​6.9.6
• deps: safe-buffer@​5.2.1
• deps: send@​0.17.2
  • deps: http-errors@​1.8.1
  • deps: ms@​2.1.3
  • pref: ignore empty http tokens
• deps: serve-static@​1.14.2
  • deps: send@​0.17.2
• deps: setprototypeof@​1.2.0

firebase/firebase-functions (firebase-functions)

v3.24.1

Compare Source

• Fix reference docs for performance monitoring.
• Fix bug where function configuration wil null values couldn't be deployed. (#​1246)

v3.24.0

Compare Source

• Add performance monitoring triggers to v2 alerts (#​1223).

v3.23.0

Compare Source

• Fixes a bug that disallowed setting customClaims and/or sessionClaims in blocking functions (#​1199).
• Add v2 Schedule Triggers (#​1177).

v3.22.0

Compare Source

• Adds RTDB Triggers for v2 functions (#​1127)
• Adds support for Firebase Admin SDK v11 (#​1151)
• Fixes bug where emulated task queue function required auth header (#​1154)

v3.21.2

Compare Source

• Fixes bug where toJSON was not defined in UserRecord (#​1125).

v3.21.1

Compare Source

• Add debug feature to enable cors option for v2 onRequest and onCall handlers. (#​1099)

v3.21.0

Compare Source

• Adds CPU option and enhances internal data structures (#​1077)
• Add auth blocking handlers (#​1080)
• Add support for secrets in v2 (#​1079)
• Update types for AlertPayloads (#​1087)
• Update AppDistribution [@type] (#​1088)
• Update CloudEvent types (#​1089)
• Generate documentation with api-extractor (#​1071)
• Change type info to be inheritance friendly. (#​1091)
• Changes the memory options from MB to MiB and GB to GiB for greater clarity (#​1090)

v3.20.1

Compare Source

• Improve authorization for tasks. (#​1073)

v3.20.0

Compare Source

• Changes internal structure to be more flexible (#​1070).

v3.19.0

Compare Source

• Add support for more regions and memory for v2 functions (#​1037).
• Fixes bug where some RTDB instance names were incorrectly parsed (#​1056).

v3.18.1

Compare Source

• Expose stack YAML via __/functions.yaml endpoint instead (#​1036).

v3.18.0

Compare Source

• Add new runtime option for setting secrets.

v3.17.2

Compare Source

• Fix issue where v2 TS users couldn't compile their code because of unexported types. (#​1033)

v3.17.1

Compare Source

• Fix issue where TS users couldn't compile their code because of unexported types. (#​1032)

v3.17.0

Compare Source

• Parallelizes network calls that occur when validating authorization for onCall handlers.
• Adds new regions to V2 API
• Fixes bug where the emulator crashed when given app without an options property.
• Adds new alerting providers

v3.16.0

Compare Source

• GCS Enhancement
• Add option to allow callable functions to ignore invalid App Check tokens
• Add firebase-admin v10 as an allowed peer dependency
• Fix bug where onCall handler failed to encode returned value with functions

firebase/firebase-tools (firebase-tools)

v9.23.3

Compare Source

• Upgrades Database Emulator to v4.7.3, removing log4j dependency.

v9.23.2

Compare Source

• Fixes issue when installing a Firebase Extension where secrets would be created before validation.
• Fixes issue with filtering on a specific storage bucket using functions in the emulator. (#​3893)
• Fixes check in Cloud Functions for Firebase initialization to check for API enablement before trying to enable them. (#​2574)
• No longer tries to clean up function build images from Artifact Registry when Artifact Registry is not enabled. (#​3943)
• Show error message when running firebase init hosting:github with no Hosting config in firebase.json. (#​3113)
• Fixes issue where remoteconfig:get was not fetching the latest version by default. (#​3559)
• Fixes issue where empty variables in .env files would instead read as multi-line values. (#​3934)

v9.23.1

Compare Source

• Corrects a bug where containers in Artifact Registry would not be deleted if a function has an upper case character in its name (#​3918)
• Fixes issue where providing the --project flag during init would not be recognized with a default project already set. (#​3870)
• Fixes issue with setting memory limits for some functions (#​3924)
• New HTTPS functions only allow secure traffic. (#​3923)
• No longer default-enable AR and don't send builds to AR unless an experiment is enabled (#​3935)

v9.23.0

Compare Source

• firebase deploy --only extensions now supports project specifc .env files. When deploying to multiple projects, param values that are different between projects can be put in extensions/${extensionInstanceId}.env.${projectIdOrAlias} and common param values can be put in extensions/${extensionInstanceId}.env.

v9.22.0

Compare Source

• Adds firebase ext:export command, and adds extensions to firebase deploy. See https://firebase.google.com/docs/extensions/reuse-project-config for more infomation on how to manage your extensions with these commands.
• Fixes issue where init would crash with multiple Hosting items selected (#​3742).
• Adds a command (crashlytics:symbols:upload) to upload native symbol files, used in Android NDK crash symbolication.

v9.21.0

Compare Source

• Fix Auth Emulator deleteTenant not working with Node Admin (#​3817).
• Fix Crashlytics Android Native Symbols not working on Windows due to ":" in the path (#​3842)
• Fixes Firestore emulator UI showing requests out of order

nodejs/node (node)

v14.21.3: 2023-02-16, Version 14.21.3 'Fermium' (LTS), @​richardlau

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
• CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.

This security release also includes an npm update for Node.js 14 to address a number
of CVEs which either do not affect Node.js or are low severity in the context of Node.js. You
can get more details for the individual CVEs in
nodejs-dependency-vuln-assessments.

Commits

• [97a0443f13] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
• [9e6221529b] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #​46566
• [0d5f86451d] - deps: update archs files for OpenSSL-1.1.1t (RafaelGSS) #​46566
• [8c11d17b40] - deps: upgrade openssl sources to 1.1.1t (RafaelGSS) #​46566
• [224e93c9ef] - deps: upgrade npm to 6.14.18 (Ruy Adorno) #​45936
• [d73ea4de13] - doc: clarify release notes for Node.js 14.21.2 (Richard Lau) #​45846
• [f7892c16be] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
• [fa115ee8ac] - module: protect against prototype mutation (Antoine du Hamel) #​44007
• [83975b7fb4] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
• [a5f8798d7a] - test: avoid left behind child processes (Richard Lau) #​46276

v14.21.2: 2022-12-13, Version 14.21.2 'Fermium' (LTS), @​richardlau

Compare Source

Notable Changes

OpenSSL 1.1.1s

This update is a bugfix release and does not address any security
vulnerabilities.

Root certificates updated to NSS 3.85

Certificates added:

• Autoridad de Certificacion Firmaprofesional CIF A626340
• Certainly Root E1
• Certainly Root R1
• D-TRUST BR Root CA 1 2020
• D-TRUST EV Root CA 1 2020
• DigiCert TLS ECC P384 Root G5
• DigiCert TLS RSA4096 Root G5
• E-Tugra Global Root CA ECC v3
• E-Tugra Global Root CA RSA v3
• HiPKI Root CA - G1
• ISRG Root X2
• Security Communication ECC RootCA1
• Security Communication RootCA3
• Telia Root CA v2
• vTrus ECC Root CA
• vTrus Root CA

Certificates removed:

• Cybertrust Global Root
• DST Root CA X3
• GlobalSign Root CA - R2
• Hellenic Academic and Research Institutions RootCA 2011

Time zone update to 2022f

Time zone data has been updated to 2022f. This includes changes to Daylight
Savings Time (DST) for Fiji and Mexico. For more information, see
https://mm.icann.org/pipermail/tz-announce/2022-October/000075.html.

Commits

• [436a596e99] - crypto: update root certificates (Luigi Pinca) #​45490
• [4b422d34af] - deps: V8: cherry-pick d2db7fa (Richard Lau) #​45785
• [625f4bf3a9] - deps: update corepack to 0.15.1 (Node.js GitHub Bot) #​45331
• [48a9810de8] - deps: update corepack to 0.15.0 (Node.js GitHub Bot) #​45235
• [9f4e64b603] - deps: update timezone to 2022f (Richard Lau) #​45521
• [f297b6bd21] - deps: update archs files for OpenSSL-1.1.1s (RafaelGSS) #​45272
• [11629fef15] - deps: upgrade openssl sources to 1.1.1s (RafaelGSS) #​45272
• [c3a90c4b44] - http2: fix memory leak when nghttp2 hd threshold is reached (rogertyang) #​41502
• [785dc3efee] - module: cjs-module-lexer WebAssembly fallback (Guy Bedford) #​43612
• [2dbeb889f6] - node-api: handle no support for external buffers (Michael Dawson) #​45181
• [5b2ea124f3] - test: add test to validate changelogs for releases (Richard Lau) #​45325
• [f13f889956] - test: add a test to ensure the correctness of timezone upgrades (Darshan Sen) #​45299
• [5608e6fa72] - tools: update certdata.txt (Luigi Pinca) #​45490
• [d6f1d7107b] - tools: have test-asan use ubuntu-20.04 (Filip Skokan) #​45581
• [370a00f737] - tools: make license-builder.sh comply with shellcheck 0.8.0 (Rich Trott) #​41258

v14.21.1: 2022-11-04, Version 14.21.1 'Fermium' (LTS), @​BethGriggs

Compare Source

This is a security release.

Notable changes

The following CVEs are fixed in this release:

• CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.

Commits

• [2b433af094] - inspector: harden IP address validation again (Tobias Nießen) nodejs-private/node-private#354

v14.21.0: 2022-11-01, Version 14.21.0 'Fermium' (LTS), @​danielleadams

Compare Source

Notable changes

• deps:
  • update corepack to 0.14.2 (Node.js GitHub Bot) #​44775
• src:
  • add --openssl-shared-config option (Daniel Bevenius) #​43124

Commits

• [773f587912] - deps: cherry-pick libuv/libuv@3a7b955 (Ben Noordhuis) #​43950
• [a1dea66956] - deps: cherry-pick libuv/libuv@abb109f (Ben Noordhuis) #​43950
• [98c49d81f5] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #​44775
• [18c43c8518] - deps: update timezone to tz2022e (Richard Lau) #​45094
• [a1f8e4db48] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #​44704
• [e55389ca86] - deps: update corepack to 0.14.0 (Node.js GitHub Bot) #​44509
• [0227462418] - deps: update corepack to 0.13.0 (Node.js GitHub Bot) #​44318
• [ee24c320ea] - deps: update corepack to 0.12.3 (Node.js GitHub Bot) #​44229
• [28e9891449] - deps: update corepack to 0.12.2 (Node.js GitHub Bot) #​44159
• [b6972c9df2] - **dep

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.